JP4193896B2 - Communication abnormality detection device - Google Patents

Description

  The present invention relates to a communication abnormality detection apparatus that analyzes information included in a packet signal that arrives from a communication network and detects an abnormality in the communication network.

  Along with the expansion of communication networks such as the Internet and the increase in communication volume, infection of malicious programs such as so-called worms to computers connected to communication networks, and multiple computers infected by worms against specific servers DDos (Distributed Denial of Service) attack that attacks is a problem. In recent years, as a countermeasure against these problems, a method of installing a device for detecting an abnormality in a communication network at a specific location on the communication network and acquiring information contained in a packet signal over a long period of time has been used. became. In this method, means such as analyzing information acquired over a long period of time, grasping the normal communication state from the result obtained by the analysis, and detecting the occurrence of an abnormality in the communication network based on the normal communication state. Is used.

For example, a monitoring device for monitoring information communicated on the communication network is installed over a wide area on the communication network, and anomalies on the communication network are detected by comprehensively analyzing the information detected by these monitoring devices. Non-Patent Document 1 discloses a technique to do this.
"Integrated Analysis Architecture for Wide Area Security Monitoring" Takemori, Yamada, Miyake The 2006 Symposium on Cryptography and Information Security Hiroshima, Japan, Jan, 17-20, 2006 The Institute of Electronics, Information and Communication Engineers

  However, in the technique disclosed in Non-Patent Document 1, as shown in Section 4.1.1 of the document, the statistical data obtained immediately before the monitoring device to detect an abnormality on the communication network and the week before Based on the statistical data obtained, the detection of abnormal occurrence is performed. Therefore, it is necessary to accumulate communication information for at least about one week after the monitoring device is installed on the communication network, and there is a problem that an abnormality occurrence in the communication network cannot be detected during that time.

  In general, when the connection configuration of the communication network is changed, the normal communication state obtained by monitoring before the change is different from the communication state after the change, so it is actually normal. There was a problem of continuing to show the analysis result that an abnormality occurred.

  The present invention has been made in view of the above-described problems, and an object of the present invention is to provide an apparatus capable of detecting occurrence of an abnormality in a communication network in a short period of time after installation on the communication network.

  Another object of the present invention is to provide an apparatus capable of showing a correct detection result at an early stage even when the connection configuration of a communication network is changed.

  The communication abnormality detection device according to the present invention sequentially selects packet signals received by the packet reception unit based on a sampling method supplied and a packet reception unit that sequentially receives packet signals coming from a communication network, A sampling unit for extracting accompanying information contained in the selected packet signal, an information storage unit for storing accompanying information extracted by the sampling unit, and accompanying information stored in the information storage unit based on a data analysis technique And an abnormality detection processing unit that performs an abnormality detection process in the communication network, and the amount of incidental information accumulated in the information accumulation unit has reached a predetermined amount In this case, a sampling method is provided to the sampling unit, and a data analysis method corresponding to the sampling method is provided to the abnormality detection processing unit. Characterized in that it comprises a trigger unit for.

  Further, the communication abnormality detection device according to the present invention includes a packet receiver that sequentially receives packet signals coming from a communication network, and a packet signal received by the packet receiver based on a supplied sampling method and information extraction interval. Are sequentially selected, the sampling unit that extracts the accompanying information included in the selected packet signal, the information storage unit that stores the accompanying information extracted by the sampling unit, and the information storage unit based on the data analysis method A communication abnormality detection apparatus including an abnormality detection processing unit that analyzes accumulated information and performs an abnormality detection process in the communication network, wherein the sampling method corresponds to the sampling method. Trigger units that supply data analysis techniques to the abnormality detection processing unit, and That each accumulated amount of accompanying information reaches a predetermined amount, the information extraction interval, characterized in that it comprises an analysis controller for supplying to said sampling unit.

  Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

  FIG. 1 is a block diagram showing a communication abnormality detection device 10 according to the present invention.

  The communication abnormality detection device 10 includes a packet reception unit 1, a sampling unit 2, an information storage unit 3, an abnormality detection processing unit 4, an input unit 5, and a trigger unit 6.

  The packet receiving unit 1 sequentially receives packet signals from a communication network (not shown), and sequentially supplies the received packet signals to the sampling unit 2.

  The sampling unit 2 sequentially sorts the packet signals supplied from the packet receiving unit 1 based on the sampling conditions supplied from the trigger unit 6, and extracts accompanying information included in the selected packet signals. Subsequently, the sampling unit 2 supplies the extracted accompanying information to the information storage unit 3. At the same time, the sampling unit 2 notifies the trigger unit 6 that the accompanying information has been supplied to the information storage unit 3.

  The information storage unit 3 sequentially stores accompanying information supplied from the sampling unit 2. The information accumulating unit 3 accumulates incidental information used for at least an abnormality occurrence detection process for a certain period. Note that incidental information that is not used in the abnormality detection process may be discarded. The information storage unit 3 supplies accompanying information to the abnormality detection processing unit 4 in response to a request from the abnormality detection processing unit 4.

  The abnormality detection processing unit 4 requests the information storage unit 3 to supply accompanying information in response to a detection processing start command issued from the trigger unit 6. Subsequently, the abnormality detection processing unit 4 analyzes the accompanying information supplied from the information storage unit 3 based on the data analysis method supplied from the trigger unit 6, and detects the occurrence of abnormality in the communication network (not shown). I do.

  The input unit 5 accepts a detection process cancel input and a conversion range input when converting incidental information input by an administrator of the communication abnormality detection device 10 or a communication state monitor.

  The trigger unit 6 issues a detection processing start command to the abnormality detection processing unit 4 every time the sampling unit 2 notifies that the accompanying information is supplied to the information storage unit 3. Usually, the trigger unit 6 supplies an initial sampling method to the sampling unit 2 and a data analysis method corresponding to the initial sampling method to the abnormality detection processing unit 4 at the time of initial setting. The initial setting is performed, for example, when the communication abnormality detection device 10 is installed on the communication network. In addition, when the amount of incidental information stored in the information storage unit 3 reaches a predetermined amount, the trigger unit 6 corresponds to the standard sampling method to the sampling unit 2 using a standard sampling method different from the initial sampling method. The data analysis method performed is supplied to the abnormality detection processing unit 4. The predetermined amount here is an amount that is at least greater than an amount that can be analyzed by the standard sampling method. The predetermined amount is stored in advance in the trigger unit 6. In general, simultaneously with the supply of the sampling method, related variables and the like are also supplied to the sampling unit 2. In the present embodiment, the initial sampling method is a packet count-based sampling method, and the standard sampling method is a time-based sampling method. Both of these methods may be standard sampling methods defined by the IETF (Internet Engineering Task Force) psamp (Packet Sampling) working group.

  FIG. 2 is a diagram illustrating an example of an extraction period of accompanying information in the time-based sampling method. The X axis represents elapsed time, and the Y axis represents the amount of accompanying information extracted. Each of D1 to D8 in the figure represents a period during which the sampling unit 2 extracts the accompanying information. Here, it is assumed that the amount of accompanying information extracted in each of D1 to D8 is the same amount. Each of S1 to S7 in the figure represents a time interval of each of the extraction periods D1 to D2, D2 to D3, ..., D7 to D8. The extraction periods D1 to D8 and the time intervals S1 to S7 are stored in the trigger unit 6 in advance, and the trigger unit 6 supplies sampling conditions including these to the sampling unit 2. If at least one or more packet signals are included in each of the extraction periods D1 to D8, the sampling unit 2 sequentially selects the packet signals based on the sampling conditions, and is included in the selected packet signals. Accompanying information is extracted. Here, it is assumed that the accompanying information extracted in each of the extraction periods D1 to D7 is necessary before the accompanying information extracted in the extraction period D8 is analyzed.

  FIG. 3 is a diagram illustrating an example of an extraction period of accompanying information in the packet count-based sampling method. The X axis represents elapsed time, and the Y axis represents the amount of accompanying information extracted. Each of D1 to D8 in the figure is a series of packet signal sequences composed of at least one or more packet signals, and represents a period during which the sampling unit 2 extracts the accompanying information. Here, it is assumed that the amount of accompanying information extracted in each of D1 to D8 is the same amount. S1 in the figure represents a time interval from when the packet signal sequence D1 arrives at the communication abnormality detection device 10 to when the packet signal sequence D2 arrives at the communication abnormality detection device 10. Similarly, each of S1 to S7 is a packet signal from the arrival of the packet signal sequence D2 to the arrival of the packet signal sequence D3, from the arrival of the packet signal sequence D3 to the arrival of the packet signal sequence D4,. This represents the time interval from the arrival of the sequence D7 to the arrival of the packet signal sequence D8. The sampling unit 2 sequentially sorts the packet signals included in each of the packet signal sequences D1 to D8 based on the sampling condition, and extracts accompanying information included in the selected packet signals. Here, it is assumed that the accompanying information extracted in each of the packet signal sequences D1 to D7 is necessary until the accompanying information extracted in the extraction period D8 is analyzed.

  The accompanying information extracted by the sampling unit 2 is, for example, communication protocol information included in the packet signal. Communication protocol information includes TCP (Transmission Control Protocol) and UDP (User Datagram Protocol). In this case, for example, the abnormality detection processing unit 4 determines whether each type of the plurality of communication protocol information already stored in the information storage unit 3 is TCP or UDP, and determines the total amount of communication protocol information. Analysis is performed such as obtaining the composition ratio of each of TCP and UDP, and the analysis result is used as the composition ratio in the normal state of the communication network. Subsequently, for example, the abnormality detection processing unit 4 analyzes the latest incidental information stored in the information storage unit, sets the analysis result to the latest state of the communication network, and analyzes the latest composition ratio and the configuration ratio in the normal state. An abnormality occurrence detection process is performed by, for example, obtaining the degree of abnormality in the communication network by comparing the ratios of the two.

  While the time-based sampling method extracts the accompanying information at a predetermined time interval, the packet count-based sampling method extracts the accompanying information every time a packet signal sequence arrives. The use of the method has an advantage that the period for extracting the accompanying information is short before the detection process of occurrence of abnormality is started. The accompanying information extraction period until the start of the abnormality occurrence detection process is indicated by the sum of the time intervals S1 to S7 in the examples shown in FIGS. The total amount of the time intervals S1 to S7 is smaller in the packet count-based sampling method shown in FIG. 3 than in the time-based sampling method shown in FIG. The extraction period of accompanying information is short.

  Whether or not the current communication state is normal by determining the normal state of the communication network based on the accompanying information extracted in the past and comparing the determined normal state with the latest extracted accompanying information. , The accuracy of analysis can be improved by setting an appropriate time interval for extracting the accompanying information. Therefore, the time-based sampling method that extracts the incidental information at a predetermined appropriate time interval is more abnormal than the packet count-based sampling method that extracts the incidental information from the packet signal sequence that arrives in a short time. This has the advantage of high detection accuracy. In the present embodiment, in view of the advantages of both methods described above, at the time of installation of the communication abnormality detection device 10, a packet count-based sampling method is used and stored in advance in order to perform an abnormality occurrence detection process at an early stage. When a predetermined amount or more of data is accumulated, the time base sampling method is changed in order to improve the detection accuracy of occurrence of abnormality.

  FIG. 4 is a flowchart showing an example of a sampling method changing routine in the trigger unit 6. In the present embodiment, it is assumed that the trigger unit 6 supplies a packet count-based sampling method to the sampling unit 2 and a data analysis method corresponding to the method to the abnormality detection processing unit 4 at the time of initialization. In addition, the initial setting in the present embodiment is performed when the communication abnormality detection device 10 is installed on the communication network. The trigger unit 6 determines whether or not the amount of accompanying information stored in the information storage unit has reached a predetermined amount (S1). The determination is made, for example, every time the sampling unit 2 notifies that the accompanying information is supplied to the information storage unit 3. The predetermined amount here is an amount that is at least greater than an amount that can be analyzed by the time-based sampling method. The trigger unit 6 supplies a time-based sampling method to the sampling unit 2 when the accumulation amount of the accompanying information accumulated in the information accumulation unit 3 reaches a predetermined amount stored in advance (S2). At the same time, the trigger unit 6 supplies a data analysis method corresponding to the time-based sampling method to the abnormality detection processing unit 4. When the input unit 5 accepts the detection process cancel input (S3), the trigger unit 6 temporarily cancels the detection process and supplies a packet count-based sampling method to the sampling unit 2 (S4). At the same time, the trigger unit 6 supplies a data analysis method corresponding to the packet count-based sampling method to the abnormality detection processing unit 4. Subsequently, the trigger unit 6 returns to the process (S1) for determining whether or not the amount of accompanying information stored in the information storage unit has reached a predetermined amount. The detection process cancellation input may be input when the sampling unit 2 extracts the accompanying information using the packet count-based sampling method. Even in this case, the trigger unit 6 once cancels the detection process, and supplies the sampling unit 2 with a packet count-based sampling method.

  In the processing described above, the sampling unit 2 is based on the time-based sampling method when the time-based sampling method is supplied from the trigger unit 6, and the packet when the packet-counting sampling method is supplied from the trigger unit 6. Based on the count-based sampling method, the packet signals supplied from the packet receiving unit 1 are sequentially sorted, and accompanying information contained in the sorted packet signals is extracted.

  When the time-based sampling method is supplied from the trigger unit 6, the abnormality detection processing unit 4 extracts all or part of the accompanying information extracted by the packet count-based sampling method and stored in the information storage unit 3. It has a function to convert to accompanying information in a format that can be analyzed by a time-based sampling method. The abnormality detection processing unit 4 analyzes the converted incidental information and the incidental information extracted by the time-based sampling method and accumulated in the information accumulation unit 3, and performs an abnormality occurrence detection process in the communication network. The accompanying information stored in the information storage unit 3 can also be used effectively. Further, when the conversion range when the administrator of the communication abnormality detection device 10 or the communication status monitor converts the accompanying information is input to the input unit 5, the abnormality detection processing unit 4 includes the input conversion range. Based on this, all or part of the accompanying information extracted by the packet count-based sampling method and stored in the information storage unit 3 can be converted into accompanying information in a format that can be analyzed by the time-based sampling method. If the accompanying information extracted by the packet count-based sampling method and stored in the information storage unit 3 cannot be converted into accompanying information in a format that can be analyzed by the time-based sampling method, the sampling unit 2 In parallel with extracting the incidental information in a format that can be analyzed by the count-based sampling method, the incidental information is also extracted in a format that can be analyzed by the time-based sampling method from the installation time of the communication abnormality detection device 10. . In this case, from the time of switching to the time-based sampling method, by using the accompanying information extracted in a format that can be analyzed by the time-based sampling method, an abnormality occurrence detection process is performed immediately from the time of switching the sampling method. be able to.

  FIG. 5 is a diagram illustrating an example of an analysis result of accompanying information by the abnormality detection processing unit 4. The figure above the arrow is an example in the case of using the time-based sampling method continuously from the installation time of the communication abnormality detection device 10. The figure below the arrow shows an example in which a packet count-based sampling method is used at the time of installation of the communication anomaly detection apparatus 10 and a time-based sampling method is used when accompanying information of a predetermined amount or more stored in advance is accumulated. It is. The X axis represents the elapsed time, and the Y axis represents the degree of abnormality, which is the analysis result. Further, the time when the communication abnormality detection apparatus 10 is installed on the communication network is set to time 0.

  When the time-based sampling method is used continuously from the time of installation of the communication abnormality detection device 10 (the figure on the upper side of the arrow in the figure), the period until the abnormality detection process starts is the period A1 in the figure. . At the time of installation of the communication abnormality detection device 10, when the packet count-based sampling method is used (the figure below the arrow in the figure), the period until the abnormality detection process starts is the period A2 in the figure. . Compared with the period A1 in the figure, the packet count-based sampling method requires a shorter extraction period of the accompanying information from the installation of the communication abnormality detection device 10 to the start of the abnormality occurrence detection process compared to the time-based sampling method. Thus, the abnormality detection process can be started in a short period A2. Further, when a predetermined amount or more of data stored in advance is accumulated, the detection processing of abnormality occurrence with high analysis accuracy can be continued by changing from the packet count-based sampling method to the time-based sampling method.

  FIG. 6 is a diagram illustrating an example of an analysis result of accompanying information by the abnormality detection processing unit 4 when there is no detection process cancel input and when there is a cancel input. The figure above the arrow is an example when there is no detection process cancel input, and the figure below the arrow is when the detection process cancel input is present. The X axis represents the elapsed time, and the Y axis represents the degree of abnormality, which is the analysis result. The time when the connection configuration of the communication network is changed is time C in the figure. The time when the input unit 5 accepts the detection process cancel input is defined as time R in FIG.

  If the connection configuration of the communication network is changed (the figure above the arrow in the figure), the normal communication state obtained by the analysis before the configuration change and the communication state after the configuration change are different. After the time C when the configuration is changed, an analysis result having a large degree of abnormality continues to be displayed even though the communication state is actually normal. When an administrator of the communication abnormality detection device 10 or a communication state monitor receives a change in the connection configuration of the communication network and performs a detection process cancel input to the input unit 5, the detection process is temporarily canceled. In order to restart the detection process in a short period after the detection process is released, the trigger unit 6 applies the packet count base sampling method to the sampling unit 2 and the data analysis method corresponding to the packet count base sampling method to the analysis control unit 7. Supply. In this case, as shown in the lower diagram of the arrow in FIG. 6, after time R, an abnormality occurrence detection process using a packet count-based sampling method is performed. Therefore, even if the connection configuration of the communication network is changed and the analysis result with a large degree of abnormality is shown even though the communication state is actually normal, by canceling the detection process once, Anomaly detection processing can be resumed in a short period of time.

  As described above, according to the present invention, it is possible to detect the occurrence of an abnormality in the communication network in a short period of time after the communication abnormality detection device is installed on the communication network. Further, according to the present invention, even when the connection configuration of the communication network is changed, it is possible to cancel the detection process once and show a correct detection result at an early stage.

  FIG. 7 is a block diagram showing a communication abnormality detection device 10 according to the present invention further including an analysis control unit 7. Since the blocks other than the analysis control unit 7 are the same as those in the first embodiment, the description thereof is omitted here.

  The analysis control unit 7 is connected to the sampling unit 2 and supplies an information extraction interval of the packet signal thereto. First, the information extraction interval is supplied to the sampling unit 2 at an initial setting stage such as when the communication abnormality detection device 10 is installed. Usually, the information extraction interval supplied to the sampling unit 2 at this time is a relatively narrow interval in order to start the analysis of the accompanying information at an early stage. Further, the analysis control unit 7 supplies the information extraction interval to the sampling unit 2 every time the amount of accompanying information accumulated in the information accumulation unit 3 reaches a predetermined amount. Normally, the information extraction interval supplied to the sampling unit 2 at this time is wider than the information extraction interval supplied immediately before. The analysis control unit 7 stores in advance at least one predetermined amount and information extraction interval. The analysis control unit 7 is also connected to the information storage unit 3, and supplies an information extraction interval to the sampling unit 2 based on the amount of accompanying information stored therein. Further, the analysis control unit 7 converts the information extracted into the form that can be used after the information extraction interval is expanded, for example, by combining the accompanying information extracted in a relatively narrow information extraction interval and already stored in the information storage unit 3. Moreover, the analysis control part 7 is connected to the trigger part 6, and notifies the information extraction interval and the analysis timing of the accompanying information to this.

  FIG. 8 is a diagram illustrating an example of an information extraction interval changing routine in the analysis control unit 7. Also in this embodiment, the trigger unit 6 supplies the packet count-based sampling method to the sampling unit 2 and the data analysis method corresponding to the method to the abnormality detection processing unit 4 when the communication abnormality detection device 10 is installed. And

  The analysis control unit 7 determines whether or not the amount of accompanying information stored in the information storage unit 3 has reached a predetermined amount stored in advance (T1). For example, each time the sampling unit 2 extracts the accompanying information, the processing is performed by the analysis control unit 7 reducing the accumulated amount of the accompanying information accumulated in the information accumulating unit 3 and the predetermined amount stored in advance by a predetermined amount. This is done by comparing the items in order. When the accumulated amount of the accompanying information reaches the predetermined amount (T1), the analysis control unit 7 supplies an information extraction interval wider than the information extraction interval supplied to the sampling unit 2 immediately before (T2). The supplied information extraction interval is such an interval that the analysis accuracy is not significantly reduced. Further, when expanding the information extraction interval of the accompanying information, the analysis control unit 7 can use the accompanying information extracted at the interval before the expansion and already stored in the information storage unit 3 after the information extraction interval is expanded. Convert to form (T3). In addition, if the information extraction interval becomes too wide, the analysis accuracy decreases. Therefore, when the information extraction interval is increased to an appropriate interval (T4), the analysis control unit 7 stops expanding the information extraction interval. When the information extraction interval is not expanded to the upper limit (T4), the process returns to the process (T1) for determining whether or not the amount of accompanying information has reached a predetermined amount. The upper limit value of the information extraction interval is stored in advance in the analysis control unit 7. The sampling unit 2 can extract the accompanying information while gradually expanding the extraction interval by being supplied with the information extraction interval from the analysis control unit 7 by the above-described processing.

  Subsequent to the processing shown in FIG. 8, as in the first embodiment, the trigger unit 6 uses a time-based sampling method when the amount of incidental information stored in the information storage unit 3 reaches a predetermined amount. 2, a data analysis method corresponding to the method is supplied to the abnormality detection processing unit 4. The predetermined amount is normally set to an amount larger than the predetermined amount used when expanding the information extraction interval. At this time, as in the first embodiment, the abnormality detection processing unit 4 analyzes all or part of the accompanying information extracted by the packet count-based sampling method and stored in the information storage unit 3 by the time-based sampling method. Convert to accompanying information in a possible format. The analysis control unit 7 does not perform the extraction interval changing process until the amount of accompanying information necessary for analysis using the time-based sampling method is accumulated after the information extraction interval changing process is completed. 6 is informed of the analysis timing.

  As in the first embodiment, when the connection configuration of the communication network is changed, when the administrator of the communication abnormality detection apparatus 10 or the communication state monitor inputs the detection process to the input unit 5, the detection process is temporarily performed. Canceled. After the cancellation, when the extraction process of the accompanying information is resumed, the analysis control unit 7 supplies the information extraction interval of a relatively narrow interval to the sampling unit 2 and increases the amount of the accompanying information accumulated, similarly to the above-described processing. The sampling interval expanded step by step is supplied to the sampling unit 2.

  As the incident information extraction interval is shorter, the incident information necessary for the analysis can be accumulated in a shorter time, and the abnormality detection process can be started earlier. However, when the accumulation period is long, the amount of accompanying information may exceed the amount that can be accumulated in the information accumulation unit 3. As described above, in the initial stage of extracting the accompanying information, it is possible to start the detection process at an early stage by extracting the accompanying information at a narrow extraction interval, and the accompanying information is such that the analysis accuracy does not decrease even if the information extraction interval is widened. In the present invention, it is possible in the present invention to continue the detection process while maintaining the analysis accuracy while suppressing the amount of the accompanying information stored in the information storage unit 3 by increasing the extraction interval of the accompanying information.

  As described above, according to the present embodiment, it is possible in the present invention to detect the occurrence of an abnormality in the communication network in a shorter period of time after the communication abnormality detection device is installed on the communication network. Further, according to the present embodiment, even when the connection configuration of the communication network is changed, it is possible in the present invention to once cancel the detection process and show a correct detection result earlier.

It is a block diagram showing the communication abnormality detection apparatus by this invention. It is a figure showing the example of the extraction period of the accompanying information in a packet count base sampling method. It is a figure showing the example of the extraction period of the accompanying information in a time base sampling method. It is a flowchart showing the example of the change routine of a sampling method. It is a figure showing the example of the analysis result of accompanying information. It is a figure showing the example of the analysis result of accompanying information. It is a block diagram showing the communication abnormality detection apparatus by this invention. It is a flowchart showing the example of the change routine of an information extraction interval.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Packet reception part 2 Sampling part 3 Information storage part 4 Abnormality detection process part 5 Input part 6 Trigger part 7 Analysis control part 10 Communication abnormality detection apparatus

Claims (13)

A packet receiver for sequentially receiving packet signals coming from the communication network;
A sampling unit that sequentially sorts the packet signals received by the packet reception unit based on the supplied sampling method, and extracts accompanying information included in the selected packet signal;
An information storage unit for storing accompanying information extracted by the sampling unit;
Analyzing incidental information stored in the information storage unit based on a data analysis method, a communication abnormality detection device including an abnormality detection processing unit that performs detection processing of abnormality occurrence in the communication network,
Trigger for supplying a sampling method to the sampling unit and a data analysis method corresponding to the sampling method to the abnormality detection processing unit when the amount of incidental information stored in the information storage unit reaches a predetermined amount The communication abnormality detection apparatus characterized by including a part. The trigger unit is an initial sampling setting means for supplying an initial sampling method to the sampling unit at the time of initial setting, and a data analysis method corresponding to the initial sampling method to the abnormality detection processing unit, respectively.
When the amount of incidental information stored in the information storage unit reaches a predetermined amount, a standard sampling method is supplied to the sampling unit, and a data analysis method corresponding to the standard sampling method is supplied to the abnormality detection processing unit. The communication abnormality detection device according to claim 1, further comprising: a standard sampling setting unit that performs. An input unit for receiving the detection process cancel input;
The trigger unit includes a unit that cancels the detection process in response to a cancel input, and supplies the sampling method to the sampling unit and a data analysis method corresponding to the sampling method to the abnormality detection processing unit. The communication abnormality detection device according to claim 1, wherein When the abnormality detection processing unit is supplied with a data analysis method corresponding to the standard sampling method from the trigger unit, all of the accompanying information extracted by the initial sampling method and stored in the information storage unit or Means for converting a part of the information into accompanying information in a format that can be analyzed by a data analysis method corresponding to the standard sampling method,
3. The detection of occurrence of abnormality in the communication network is performed by analyzing the converted accompanying information and the accompanying information extracted by the standard sampling method and stored in the information storage unit. The communication abnormality detection device described. An input unit that accepts a conversion range of accompanying information stored in the information storage unit;
The abnormality detection processing unit converts all or part of the accompanying information extracted by the initial sampling method based on the conversion range and stored in the information storage unit into a data analysis method corresponding to the standard sampling method. The communication abnormality detection device according to claim 4, wherein the communication abnormality detection device converts the incident information into a format that can be analyzed by the analysis.   3. The communication abnormality detection device according to claim 2, wherein the initial sampling method has a shorter extraction period of accompanying information until the detection process is performed than the standard sampling method.   The communication abnormality detection apparatus according to claim 2, wherein the initial sampling method is a packet count-based sampling method, and the standard sampling method is a time-based sampling method. A packet receiver for sequentially receiving packet signals coming from the communication network;
A sampling unit that sequentially sorts the packet signals received by the packet receiving unit based on the supplied sampling method and information extraction interval, and extracts accompanying information included in the selected packet signal;
An information storage unit for storing accompanying information extracted by the sampling unit;
Analyzing incidental information stored in the information storage unit based on a data analysis method, a communication abnormality detection device including an abnormality detection processing unit that performs detection processing of abnormality occurrence in the communication network,
A trigger unit that supplies a sampling method to the sampling unit, and a data analysis method corresponding to the sampling method to the abnormality detection processing unit, and
A communication abnormality detection apparatus comprising: an analysis control unit that supplies an information extraction interval to the sampling unit every time the amount of incidental information stored in the information storage unit reaches a predetermined amount.   The communication abnormality detection device according to claim 8, wherein an information extraction interval supplied to the sampling unit by the analysis control unit is wider than an information extraction interval supplied to the sampling unit immediately before.   When the analysis control unit supplies the information extraction interval to the sampling unit, the analysis control unit continues the accompanying information extracted at the information extraction interval before the supply and already stored in the information storage unit even after the supply. The communication abnormality detection device according to claim 8, wherein the abnormality detection processing unit is converted into a form that can be analyzed. An input unit for receiving the detection process cancel input;
The communication abnormality detection device according to claim 8, wherein the analysis control unit further includes a unit that cancels the detection process in response to a cancel input and supplies an information extraction interval to the sampling unit.   9. The communication abnormality detection device according to claim 1, wherein the accompanying information is communication protocol information included in the packet signal.   The abnormality detection processing unit analyzes the incidental information already accumulated in the information accumulation unit, sets the analysis result to a normal state of the communication network, and analyzes the latest incidental information accumulated in the information accumulation unit. 9. The abnormality detection process according to claim 1 or 8, wherein the analysis result is set to a latest state of the communication network, and a degree of abnormality in the communication network is obtained by comparing the normal state and the latest state. Communication abnormality detection device.

Images